If this is your first visit, be sure to
check out the Forum Rules by clicking the
link above. You may have to register
before you can post: click the register link above to proceed. To start viewing messages,
select the forum that you want to visit from the selection below.

Need help with data recovery

A crap JMicron USB controller messed up my backup drive, and I can't recover it with testdisk. It was an 80GB NTFS partition on an 80GB drive, but testdisk cannot recover it - it appears to be a 160GB file. Is there any way I can manually edit the deleted volume size to be 80GB?

I imagine you tried using something like Knoppix or Bart PE to see if the drive will mount? There have been times on a fuxored drive I left Knoppix running on it all night and the drive finally mounted, after about 4 or 5 hours. That would be a good place to start. If you can actually get it mounted, maybe move the data little by little, or if your brave enough, image it, then run the recovery on the image

Before you do anything, can I suggest that you do nothing and just stop for a second and think about how valuable the data is.

If the data is very valuable, I wouldn't go near the drive, I'd kill the power straight away and go to see someone who specialises in data recovery.

Of course though, if the data isn't too important, you can try recover it yourself, but be warned that this all-too-often leads to disaster.

About a year or two ago, I backed up all my personal stuff onto a CD-R. I was stupid enough to wipe my hard disk without first checking that the CD-R burned correctly. That day I ran around trying the CD in about 10 different computers, no joy.

I still have that CD-R, I suppose I'm hoping that some day, some where, somebody will be able to read from it. (Actually right now I'm gonna go try it in a Bluray drive).

Ask questions on the open forums, that way everybody benefits from the solution, and everybody can be corrected when they make mistakes. Don't send me private messages asking questions that should be asked on the open forums, I won't respond. I decline all "Friend Requests".

It isn't too important, just convient to have. Since testdisk was complaining about disk size, I went ahead and made a copy of the 80GB drive onto an empty 200GB drive I had laying around. So if anything happens, I still have a copy. The next problem is that when the FS is restored, it structure is bad, and it isn't in the right location. Instead of being in the first 74.53GB, it appears taking up the second 74.53GB. This is what I mean:

The data is on the first portion of the drive, while the filesystem is elsewhere. Can I manually change the filesystem's metadata so that it is in the right location?

I just wonder.....what to do when your system (windows/linux) doesn't even recognize the hard drive anymore...which happened to me a few months ago? Is there still a way to rescue the data on it since all tools mentioned in this thread will probably not work in that case
Well, I am not talking about professional companies earning a big money with data recovery/rescue - they surely can do it.

I saw a great talk at last years Toorcon about about data recovery. Your best bet is to search ebay for an identical drive. If you can find one, you may be able to swap the circuit boards and get your drive working again. Make sure the boards have the same brand of logic chips.

A third party security audit is the IT equivalent of a colonoscopy. It's long, intrusive, very uncomfortable, and when it's done, you'll have seen things you really didn't want to see, and you'll never forget that you've had one.

There is no mechanical errors, it is entirely software issue. The problem is that the partition location is in the wrong position. I don't need to undelete the partition, I need to edit the location where the location of the parition is. In the picture I posted above, the data is located in the front of the drive, while the partition is located after the data. It is like partition start was changed to where the end was, as the original drive was 74.53GB. I can't explain how it happened, I unmounted everything, and always performed clean shutdowns.